lolibrary/lolibrary

apiVersion: v1
kind: Pod
metadata:
  name: cockroachdb-request-service-cert
  namespace: lolibrary
  labels:
    app: cockroachdb-requestor
spec:
  serviceAccountName: running-kitten-cockroachdb
  initContainers:
    # The init-certs container sends a certificate signing request to the
    # kubernetes cluster.
    # You can see pending requests using: kubectl get csr
    # CSRs can be approved using:         kubectl certificate approve <csr name>
    #
    # In addition to the client certificate and key, the init-certs entrypoint will symlink
    # the cluster CA to the certs directory.
    - name: init-certs
      image: cockroachdb/cockroach-k8s-request-cert:0.4
      imagePullPolicy: IfNotPresent
      command:
        - "/bin/ash"
        - "-ecx"
        - "/request-cert -namespace=${POD_NAMESPACE} -certs-dir=/cockroach-certs -type=client -user=service -symlink-ca-from=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
      env:
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
      volumeMounts:
        - name: cockroach-certs-service
          mountPath: /cockroach-certs
  containers:
    - name: cockroachdb-client
      image: cockroachdb/cockroach:v19.1.2
      imagePullPolicy: IfNotPresent
      volumeMounts:
        - name: cockroach-certs-service
          mountPath: /cockroach-certs
      # Keep a pod open indefinitely so kubectl exec can be used to get a shell to it
      # and run cockroach client commands, such as cockroach sql, cockroach node status, etc.
      command:
        - sleep
        - "2147483648" # 2^31
  # This pod isn't doing anything important, so don't bother waiting to terminate it.
  terminationGracePeriodSeconds: 0
  volumes:
    - name: cockroach-certs-service
      emptyDir: {}